@gitldy1013/vuepress-theme-ldy (>=1.1.2 <=1.1.3), @next-theme/plugins (>=0.0.2 <=8.1.0) +17 more potentially affected by CVE-2020-28847 via valine (>=1.3.10 <=1.4.14)

valine NPM version =1.3.10, =1.1.2, =0.0.2, =2.0.0-beta.0, =1.0.11, =0.0.1, =1.0.0, =1.0.0, =1.0.8-alpha.5, =1.1.2, =1.2.1, =1.0.1, =1.0.0, =3.0.0-beta.2, =3.0.0-beta.3 and more Source cves: CVE-2020-28847 Source advisory: OSV:GHSA-6XVQ-2GJ8-4276...

GHSA-6XVQ-2GJ8-4276 Cross site scripting in valine

valine is a fast, simple & powerful comment system. Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. A fix was released in version 1.4.15...

Cross site scripting in valine

valine is a fast, simple & powerful comment system. Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. A fix was released in version 1.4.15...

CVE-2020-28847

Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment...

CVE-2020-28847

Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment...

Cross site scripting

Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment...

CVE-2020-28847

Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment...

CVE-2020-28847

CVE-2020-28847 affects Valine (xCss Valine) 1.4.14 due to insufficient sanitization of the nick parameter in /classes/Comment, enabling cross-site scripting. The issue is documented across multiple feeds; a fix was released in version 1.4.15. Impact is XSS with user-provided nick data stored/echo...

Valine 跨站脚本漏洞

Valine is a commenting system. A cross-site scripting vulnerability exists in Valine version 1.4.14, which originates from sending to /classes/Comment via the nick parameter...

GHSA-P2C4-GXP4-J3XP Denial of service in Valine

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

@gitldy1013/vuepress-theme-ldy (>=1.1.2 <=1.1.3), @next-theme/plugins (>=0.0.2 <=8.1.0) +17 more potentially affected by CVE-2021-34801 via valine (>=1.3.10 <=1.4.14)

valine NPM version =1.3.10, =1.1.2, =0.0.2, =2.0.0-beta.0, =1.0.11, =0.0.1, =1.0.0, =1.0.0, =1.0.8-alpha.5, =1.1.2, =1.2.1, =1.0.1, =1.0.0, =3.0.0-beta.2, =3.0.0-beta.3 and more Source cves: CVE-2021-34801 Source advisory: OSV:GHSA-P2C4-GXP4-J3XP...

Denial of service in Valine

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

Code injection

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 exposes a denial-of-service (application outage) when a remote attacker supplies a User-Agent value that only specifies the product and version. The description across multiple sources confirms the vulnerability is triggered via network input and impacts availability; no explicit ex...

Valine 代码注入漏洞

Valine is a review system. A security vulnerability exists in Valine version 1.4.14, which can be exploited by a remote attacker to cause a denial of service by providing a ua value that specifies only the product and version...

GHSA-HHRP-QM88-XJR3 Valine HTML Injection

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file...

Valine HTML Injection

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file...